---
id: "CVE-2026-96406"
kind: "vulnerability"
aliases: ["CVE-2026-96406"]
title: "USBX host: oversized VideoStreaming descriptor length lets device read past buffer"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "runtime", "usb-host", "usbx", "uvc"]
not_affected_if: ["no-usb-host-stack", "trusted-devices-only"]
published_at: "2026-10-20T14:17:04+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:32:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96406", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# USBX host: oversized VideoStreaming descriptor length lets device read past buffer

The USBX USB host stack trusts a VideoStreaming interface's wTotalLength field without checking it against the configuration descriptor actually received. A malicious USB device can make the host read past the end of its configuration buffer when the application queries format or frame data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project uses the USBX host stack and the USB Video Class (UVC) host driver, for example with `grep -ri usbx` in the source tree or build files.
- Compare the USBX version against the fixed release named in the advisory (unknown in the sources).

## Fix

- Update USBX to a release that validates wTotalLength against the received configuration descriptor (fixed version unknown in the sources).
- Until patched, avoid attaching untrusted USB video devices to affected hosts.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96406

## From the sources

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received.



A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_